Investment Committee Governance: How to Steer, Not Manage

Process | Principle III | Principles of Investment Stewardship

The word "governance" comes from a Greek term meaning "to steer." It's a fitting origin for investment committees, whose core responsibility is not to manage the endowment directly, but to establish the direction, guardrails, and oversight structures that allow the endowment to be managed well.

That distinction — governance versus management — is central to Principle III of the Commonfund Institute's Principles of Investment Stewardship for Nonprofit Organizations brochure. And it's a distinction that many investment committees struggle to maintain in practice.

The Oversight Gap

Most experts conclude that committees spend too much time on manager selection and evaluation — the tactical work — to the detriment of overarching issues such as asset allocation, spending policy, and risk management. This is understandable. Manager selection is concrete and discussable. A specific manager's performance numbers are easy to put on a slide. Asset allocation decisions, spending policy reviews, and risk frameworks require more abstract, longer-horizon thinking — and they often generate less immediate momentum in a 90-minute quarterly meeting.

The Principles brochure is direct on this point: trustees should concern themselves with governance, not management. Strategic issues, not tactical ones.

Manager Selection: What the Committee's Role Actually Is

When the committee does engage with manager selection, its role is one of oversight — not execution. Internal staff, external consultants, or an Outsourced Chief Investment Officer (OCIO) can perform the detailed work of investment manager evaluation and bring recommendations forward. The committee's job is to assess the investment process across six dimensions:

• Discipline — are objectives clearly articulated with a credible rationale?
• Consistency — does the manager adhere to its strategy through all market conditions?
• Clarity — is the investment process understandable and coherent?
• Flexibility — is there latitude to adapt to evolving conditions while remaining true to core philosophy?
• Demonstrated results over the long term — 3-, 5-, and 10-year horizons or a full market cycle.
• Continuous improvement — does the firm reflect a culture that encourages learning? 

Building relationships based on trust and candor — what the Principles brochure calls the presumption of loyalty — is the foundation of a productive long-term partnership. Replacing managers solely due to short-term underperformance is inimical to this model.

The OCIO Question

One of the most consequential governance decisions an investment committee can make is whether to engage an Outsourced Chief Investment Officer. OCIO adoption is accelerating across institution types. Among independent schools, nearly half (46%) reported using an OCIO in FY2024, up from one third the prior year — with the sharpest increase among mid-sized schools, 59% of which reported using an OCIO in FY2024 compared with 40% in FY2023. Private and community foundations are showing similar trends.

The Principles brochure dedicates a full section to the OCIO model, including eight key evaluation factors: capabilities and flexibility, track record, partnership quality, thought leadership, firm structure and business model, geographic footprint, fee transparency, and team composition. Entering an OCIO relationship is not simply an operational decision. It brings new governance considerations that committees must actively address, including how fiduciary responsibility is shared and how the institution preserves strategic alignment through the transition and beyond.

Cybersecurity: The Risk Most Committees Underweight

Investment committees increasingly bear responsibility for understanding not only market risk, but the operational and cybersecurity risks embedded in their investment managers, custodians, and OCIO providers. Best practices outlined in the Principles brochure include:

• Requesting and reviewing SOC 2¹ reports or equivalent security certifications from key service providers
• Ensuring investment management agreements include appropriate data security and breach notification provisions
• Periodically reviewing business continuity and disaster recovery plans of critical service providers
• Including cybersecurity as a standing agenda item at least annually for the investment committee 

A breach or operational failure at a key service provider can have material consequences for the endowment. This is governance work, not IT work.

Succession: The Most Overlooked Risk

The departure of a long-tenured chair or deeply experienced committee member can create knowledge gaps that take years to close. Sound process means documenting the rationale behind key decisions — not just the decisions themselves — maintaining a pipeline of prospective members who are being actively oriented, and establishing term limits that create natural renewal while preserving institutional memory through staggered transitions.

Process is the infrastructure of governance. When it works well, it's invisible. When it fails, it shapes outcomes for years.

Progression and Process

Progression often brings changes to processes — staff reorganization, leadership transitions, or the decision to engage an OCIO. As institutions grow and governance needs evolve, they must anticipate how changes to process impact structure and decision-making.

A commitment to continuous improvement — reflected in ongoing process reviews, orientation programs for new committee members, and technology adoption — ensures that governance keeps pace with institutional needs. Institutions that embrace Progression don't wait for a crisis to prompt a process review; they build the review into the calendar.

The series: The Case for the Seventh P: Progression · Principle I — Purpose · Principle II — Policy · Principle III — Process · Principles  IV–VI coming soon 

1. An independent audit report that verifies a company has the proper security controls in place to protect its customers' data.